Understanding Nginx Forward and Reverse Proxy: Concepts, Workflow, and Configuration

Nginx is widely used in large‑scale websites and is a common interview topic; this article focuses on explaining Nginx forward proxy and reverse proxy in detail.

Nginx Forward Proxy

A forward proxy is a way for a client to access the Internet through an intermediate server when the client cannot directly reach the target resource (e.g., the target is blocked, throttled, or unreachable). The client sends a request to the forward proxy, which then accesses the target server and returns the result to the client.

Typical workflow:

客户端 → 正向代理（Nginx） → 目标服务器

Example: accessing www.google.com from a network where direct access is blocked by configuring an Nginx forward proxy deployed abroad; the browser sends the request to the proxy, which fetches google.com and returns the page.

Nginx Reverse Proxy

A reverse proxy sits between the client and backend servers, handling client requests on behalf of the backend. Clients interact only with the reverse proxy and are unaware of the actual backend servers.

Typical workflow:

客户端 → 反向代理（Nginx） → 后端服务器集群

Reverse proxy is extensively used in micro‑service architectures, load balancing, and gateway layers.

Key Nginx directives for reverse proxy:

proxy_pass

upstream

The upstream directive defines a group of backend servers, while proxy_pass forwards client requests to those servers. Example configuration:

upstream backend_server {
    server 192.168.1.101;
    server 192.168.1.102;
}
server {
    listen 80;
    location / {
        proxy_pass http://backend_server;
    }
}

Core Differences Between Forward and Reverse Proxy

Proxy target: forward proxy proxies the client; reverse proxy proxies the server.

Hidden object: forward proxy hides the client IP; reverse proxy hides the server IP.

Use cases: forward proxy is mainly for client‑side network access control; reverse proxy is for server‑side performance and security optimization.

Deployment location: forward proxy sits at the client’s network exit; reverse proxy sits at the service entry point.